Extracted

• • Target
    58a5e3bb70bcb50147587807794bcee8ee3c7e5c67a630b092e7899d2a50c83b.exe
  • Size 7.6MB
  • SHA256 58a5e3bb70bcb50147587807794bcee8ee3c7e5c67a630b092e7899d2a50c83b
  • MD5 58b96ec8d8838c2369a1c926da4f8702
  • SHA1 2136b9b45bdd1559f774440c574dceb389995f19
  • SHA512 d4fc63161bc7241c127ab7ff38390f3fed26484e07435484006c843e8c546ec2e3a95069618fdffe0573c533d4d52a2e40a9f573c1b22d2d55cd00494190f402
  • SSDEEP 196608:+podLmWdR4rznEOaZRICxT4LFm8aVzYGFEr175:+podLmWvYvaZOCR4Lc8GCrH
  • TLSH
    T1AA8633423B81EDE2C4548DB99FD9CF33D577EBA12AA115438BA84D08ADC34F212479DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerhijackloaderloaderstealeradwarepersistenceransomwarespyware

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2